ClickFix Attacks Now Bypass Windows Run Limits via Browser Cache

A new variant of the ClickFix attack technique is actively bypassing Windows security controls by executing malicious payloads stored in web browser caches, according to a report from The Hacker News. This development marks a significant evolution in how attackers circumvent standard operating system protections against remote code execution.

Microsoft Threat Intelligence confirmed the activity in a post on X, detailing how the attack differs from previous iterations. Instead of downloading and executing remote payloads in real-time, which is the typical pattern for ClickFix attacks, this new method relies on compromised websites to pre-fetch a script payload. The malicious script is disguised as a PNG image file and stored locally in the browser's cache. Once cached, the attacker triggers the execution of this local file, effectively bypassing Windows security features that restrict the running of code from remote sources.

Technical Mechanics and Evasion

The core of this attack lies in the manipulation of browser caching mechanisms. By disguising the malicious script as a common image format, specifically a PNG file, the payload blends in with legitimate web traffic. This obfuscation makes it difficult for standard security tools to identify the threat during the initial download phase.

Microsoft Threat Intelligence highlighted that the shift from remote execution to local cache execution is a direct response to tightening security controls. Windows operating systems have increasingly restricted the ability to run files directly from remote locations. By forcing the browser to cache the file first, the attacker transforms a remote resource into a local one. When the execution command is triggered, the system sees a local file rather than a remote script, allowing the payload to run despite security policies designed to prevent such actions.

Impact on Users and Security Posture

This technique affects users who visit compromised websites, regardless of their operating system's security settings. Because the attack relies on the browser's caching behavior, it can potentially impact multiple platforms that utilize similar caching mechanisms, though the immediate focus is on Windows environments where ClickFix attacks are prevalent.

Security professionals should note that this method reduces the reliance on user interaction beyond the initial visit to the compromised site. The pre-fetching of the payload means that the malicious code is ready to execute once the trigger is activated. This lowers the barrier for successful infection and increases the likelihood of bypassing endpoint detection and response (EDR) solutions that monitor for remote execution attempts.

What should you do?

Security teams should monitor for unusual browser cache activity and investigate any instances of scripts being executed from local cache directories. Endpoint detection rules should be updated to look for execution patterns that originate from cached web content, particularly files disguised as images. Organizations should also review their web filtering policies to ensure that known compromised sites are blocked, preventing the initial pre-fetching of malicious payloads.

What to do and how to stay safe: ClickFix

• Monitor endpoint logs for execution events originating from browser cache directories rather than standard application folders.
• Review web proxy and filtering logs to identify and block access to websites known to host ClickFix attack infrastructure.
• Educate users to be cautious of unexpected pop-ups or prompts on unfamiliar websites, as these may trigger cached payload execution.
• Ensure browser security settings are configured to limit aggressive caching behaviors for untrusted sites, if supported by the browser vendor.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does this new ClickFix attack differ from previous versions?

Previous ClickFix attacks typically downloaded and executed remote payloads in real-time, whereas this new variant pre-fetches a disguised script into the browser cache for local execution.

What type of file is used to disguise the malicious payload?

The malicious script payload is disguised as a PNG image file to avoid detection during the caching process.

Which security control does this attack bypass?

This attack bypasses Windows security restrictions that prevent the execution of code from remote sources by leveraging locally cached files.